analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
File name:

Gift Card Code Generator by amboss.zip

Full analysis: https://app.any.run/tasks/815352e3-6672-4235-8c66-fbef31858ea8
Verdict: Malicious activity
Analysis date: August 08, 2020, 18:08:48
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MIME: application/zip
File info: Zip archive data, at least v2.0 to extract
MD5:

EDE842989A4FA3934A73CF9CDF929FCB

SHA1:

82206657AC1B6CF34E5C573F58F9A459D1267FA1

SHA256:

052116BD4E077247116A0DD22CB059A0516E7B5C137FD24BDD50B2F382CD97C5

SSDEEP:

6144:ah/Mur0tf+GP3rlIe6oLCFKoCO6K3uOKzgC9YnTajms0s5YO0b0N:aCRtfdPJHremO6HrSTaZY9k

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.
  • MALICIOUS

    • Application was dropped or rewritten from another process

      • Gift Card Code Generator.exe (PID: 3000)
  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • WinRAR.exe (PID: 2804)
  • INFO

    • Dropped object may contain Bitcoin addresses

      • WinRAR.exe (PID: 2804)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.zip | ZIP compressed archive (100)

EXIF

ZIP

ZipRequiredVersion: 20
ZipBitFlag: -
ZipCompression: Deflated
ZipModifyDate: 2020:05:06 02:05:01
ZipCRC: 0xa0521664
ZipCompressedSize: 5565
ZipUncompressedSize: 13824
ZipFileName: Gift Card Code Generator.exe
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
40
Monitored processes
3
Malicious processes
0
Suspicious processes
1

Behavior graph

Click at the process to see the details
drop and start start winrar.exe gift card code generator.exe notepad.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
2804"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\AppData\Local\Temp\Gift Card Code Generator by amboss.zip"C:\Program Files\WinRAR\WinRAR.exe
explorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Version:
5.60.0
3000"C:\Users\admin\AppData\Local\Temp\Rar$EXa2804.48110\Gift Card Code Generator.exe" C:\Users\admin\AppData\Local\Temp\Rar$EXa2804.48110\Gift Card Code Generator.exe
WinRAR.exe
User:
admin
Company:
amboss
Integrity Level:
MEDIUM
Description:
Gift Card Code Generator by amboss
Exit code:
0
Version:
1.0.0.0
2264"C:\Windows\system32\NOTEPAD.EXE" C:\Users\admin\AppData\Local\Temp\Rar$DIa2804.1677\a.txt.txtC:\Windows\system32\NOTEPAD.EXEWinRAR.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Notepad
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Total events
573
Read events
536
Write events
0
Delete events
0

Modification events

No data
Executable files
3
Suspicious files
1
Text files
3
Unknown types
0

Dropped files

PID
Process
Filename
Type
2804WinRAR.exeC:\Users\admin\AppData\Local\Temp\__rzi_2804.1077
MD5:
SHA256:
3000Gift Card Code Generator.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa2804.48110\a.txt.txttext
MD5:D0E1960398A5467FD5B20536B5B2B27B
SHA256:D742BFB61F90BF91A44CE0351DDAAD579DB744FACB7D1B0DA5E7666B0737339A
2804WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DIa2804.1677\a.txt.txttext
MD5:D0E1960398A5467FD5B20536B5B2B27B
SHA256:D742BFB61F90BF91A44CE0351DDAAD579DB744FACB7D1B0DA5E7666B0737339A
2804WinRAR.exeC:\Users\admin\AppData\Local\Temp\Gift Card Code Generator by amboss.zipcompressed
MD5:C2B589A310F3BE82175BDD9C48C73A05
SHA256:E807FEA5615D886A5FB72CFBDA6CD8D37A73D65ED2382E08A20A7703D9D41CEA
2804WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa2804.48110\README.txttext
MD5:4725EA5E59E5E6B0B988830B6E17D98F
SHA256:A2EE22CE643DA7572545C21E836E50BB4426865AE155B281C9593B42D0E8A134
2804WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa2804.48110\Newtonsoft.Json.dllexecutable
MD5:4DF6C8781E70C3A4912B5BE796E6D337
SHA256:3598CCCAD5B535FEA6F93662107A4183BFD6167BF1D0F80260436093EDC2E3AF
2804WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa2804.48110\Gift Card Code Generator.exeexecutable
MD5:A4DAF8C556CDE15F0B149346FE72B6E8
SHA256:98238166595D1096E590609E854E311CFF45BF3F90E8690B16222016D9B509DD
2804WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa2804.48110\Leaf.xNet.dllexecutable
MD5:4D31626E5B7D07DEE2375E49B4671C99
SHA256:06E2EEC80A75C45CC1CA63ABC7D3DA907E49AC60FA1A24E94520DA6E61F44FE5
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
1
DNS requests
1
Threats
0

HTTP requests

No HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
3000
Gift Card Code Generator.exe
185.100.87.106:443
cracked.to
Flokinet Ltd
RO
suspicious

DNS requests

Domain
IP
Reputation
cracked.to
  • 185.100.87.106
whitelisted

Threats

PID
Process
Class
Message
Potentially Bad Traffic
ET DNS Query for .to TLD
No debug info